Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.

ThreatMon Blog

Blog from ThreatMon. ThreatMon is a technology company that specializes in delivering comprehensive cybersecurity solutions tailored to the specific needs of businesses. ThreatMon delivers an intelligence-driven cybersecurity solution. Established in 2018, our company is devoted to safeguarding digital assets from external threats. Our cutting-edge cybersecurity solutions, meticulously crafted by experienced professionals, seamlessly integrate Threat Intelligence, External Attack Surface Management, and Dark Web Intelligencen. By leveraging these technologies, we proactively identify vulnerabilities and provide tailored security solutions to our clients.